Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you set up your clock in Linux systems and select a timezone:

  • How easily can sites access this information? Can they do it through Javascript? Can they do it if Javascript is blocked?

  • Where else is this information leaked?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Yes, it's possible to retrieve information about the local system time and timezone from JavaScript. A script might fetch that and post it back to a server via Ajax or other measures. Your browser may also provide headers that include timestamps, so detection might be possible even when JavaScript is disabled.

It's impossible to iterate through all the potential ways that timezones and timestamps can be leaked, but here's a quick list:

  • JavaScript
  • Flash, Java, etc. plugins.
  • HTTP headers
  • Cache detection tricks
  • Cookie tricks (e.g. setting a cookie to expire at a fixed date, then see when it expires)

All in all, though, I wouldn't be too worried. Timezones are a very weak identifier of location. I'd be much more worried about IP-based geolocation, ping triangulation, direct access to location services, etc.

share|improve this answer

Aside from the web browser, here are a few other places where timezone information may be leaked:

  • Any emails you send from a local client will likely contain your timezone offset in the "Date" header
  • Some programs will save timezone-specific information in their output files. For instance, git will store your timezone offset any time you make a commit, and this is available to anybody reading the git repository.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.